Method Middleware

codersdk/deployment.go:1016–1067

Middleware handles some cookie mutation the requests. For performance of this, see 'BenchmarkHTTPCookieConfigMiddleware' This code is executed on every request, so efficiency is important. If making changes, please consider the performance implications and run benchmarks.

(next http.Handler)

// This code is executed on every request, so efficiency is important.
// If making changes, please consider the performance implications and run benchmarks.
func (cfg *HTTPCookieConfig) Middleware(next http.Handler) http.Handler {
	prefixed := make(map[string]struct{})
	for name := range cookiesToPrefix {
		prefixed[cookieHostPrefix+name] = struct{}{}
	}
	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		if !cfg.EnableHostPrefix {
			// If a deployment has this config on, then turned it off. Then some old __Host-
			// cookies could exist on the browsers of the clients. These cookies have no
			// impact, so we are going to ignore them if they exist (niche scenario)
			next.ServeHTTP(rw, r)
			return
		}

		// When 'EnableHostPrefix', some cookies are set with a `__Host-` prefix. This
		// middleware will strip any prefixes, so the backend is unaware of this security
		// feature.
		//
		// This code also handles any unprefixed cookies that are now invalid.
		cookies := r.Cookies()
		for i, c := range cookies {
			// If any cookies that should be prefixed are found without the prefix, remove
			// them from the client and the request. This is usually from a migration where
			// the prefix was just turned on. In any case, these cookies MUST be dropped
			if _, ok := cookiesToPrefix[c.Name]; ok {
				// Remove the cookie from the client to prevent any future requests from sending it.
				http.SetCookie(rw, &http.Cookie{
					MaxAge: -1, // Delete
					Name:   c.Name,
					Path:   "/",
				})
				// And remove it from the request so the rest of the code doesn't see it.
				cookies[i] = nil
			}

			// Only strip prefix's from the cookies we care about. Let other `__Host-` cookies be
			if _, ok := prefixed[c.Name]; ok {
				c.Name = strings.TrimPrefix(c.Name, cookieHostPrefix)
			}
		}

		// r.Cookies() returns copies, so we need to rebuild the header.
		r.Header.Del("Cookie")
		for _, c := range cookies {
			if c != nil {
				r.AddCookie(c)
			}
		}

		next.ServeHTTP(rw, r)
	})
}

func (cfg *HTTPCookieConfig) Apply(c *http.Cookie) *http.Cookie {
	c.Secure = cfg.Secure.Value()